Given 3 ethernet interfaces, I'd like to accomplish this:
eth0 -> WAN eth1 -> EAPoL authenticator eth2 -> IP Nat to private network
In this scenario, I would like ebtables to filter and forward ethernet frames of type 0x888E (EAPoL) to/from the WAN through eth1 which will have the EAPoL authenticator connected. The remaining traffic I would like to IP NAT to eth2.
I was reading about brouting here:
Though it's not clear how I use the above for layer 2 filtering.
Instead, what i've tried so far was to create a bridge with eth0 and eth1 and then an ebtables filtering rule so that only EAPoL traffic arrives on eth1:
ebtables -t filter -A FORWARD -i eth0 -p 0x888e -j ACCEPT ebtables -t filter -A FORWARD -i eth0 -j DROP ebtables -t filter -A FORWARD -o eth0 -p 0x888e -j ACCEPT ebtables -t filter -A FORWARD -o eth0 -j DROP
Then I IP NAT between eth0 and eth2:
iptables -t nat -A POSTROUTING -o eth0-j MASQUERADE iptables -A FORWARD -i eth2 -j ACCEPT
unfortunately, I can't get BOTH of these to work at the same time, only one or the other.
Any ideas? Appreciate any thoughts or tips